Privacy Policy

Version: 1.0  |  Last Updated: 09 November 2026

1. Introduction

Welcome to Spinbob, operated through spinbobuk.com (referred to in this document as "we", "us", or "our"). We are committed to protecting the privacy and personal data of every individual who visits, registers with, or uses our website and services (collectively referred to as "you" or the "User").

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you interact with Spinbob. It has been prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations (PECR). By accessing or using our services, you acknowledge that you have read and understood this policy.

This document should be read alongside our Terms & Conditions and our Responsible Gaming page, which together form the complete regulatory framework governing your use of Spinbob.

2. Data We Collect

We collect personal data only to the extent necessary for the purposes described in this policy. The categories of data we collect include:

2.1. Identity & Contact Data

• Full name and date of birth
• Username or screen name chosen during registration
• Email address and telephone number
• Residential address, city, county, and postcode
• Nationality and country of residence

2.2. Identity Verification Data

• Copies of government-issued identity documents (e.g. passport, driving licence)
• Proof of address documentation (e.g. utility bill, bank statement)
• Source-of-funds or source-of-wealth documentation where required by law

2.3. Financial Data

• Payment card details (card number, expiry date — we do not store full CVV data)
• Bank account details used for deposits or withdrawals
• Transaction history, deposit and withdrawal records
• Preferred payment method (e.g. Visa, Mastercard, PayPal, Skrill, Neteller, Apple Pay, Google Pay, Paysafecard, bank transfer, Trustly, Revolut, Klarna)

2.4. Technical & Usage Data

• IP address, browser type and version, operating system
• Device identifiers, screen resolution, and language settings
• Pages visited, session duration, clickstream data, and game history
• Login timestamps, geolocation data (derived from IP address)

2.5. Communications Data

• Records of correspondence with our support team (email, live chat, telephone)
• Feedback, complaints, and survey responses you submit
• Marketing preferences and opt-in/opt-out records

2.6. Responsible Gaming Data

• Self-exclusion requests, deposit limits, cooling-off periods, and reality-check settings
• Affordability and vulnerability assessment responses where applicable

We do not intentionally collect special category data (such as health, racial or ethnic origin, religious beliefs, or biometric data) unless you voluntarily disclose it during a responsible gaming interaction or a legal compliance process, in which case it is processed under the conditions set out in Article 9 UK GDPR.

3. How We Use Your Data

We process your personal data for the following purposes:

3.1. Account Registration & Service Delivery

To create and manage your Spinbob account, verify your identity, process deposits and withdrawals in GBP (£), provide customer support, and deliver the gaming services you have requested.

3.2. Legal & Regulatory Compliance

To fulfil our obligations under anti-money laundering (AML) legislation, know-your-customer (KYC) requirements, age verification rules, and any other applicable laws or regulatory guidance. This includes verifying that all users are aged 18 or over before allowing access to real-money gambling services.

3.3. Responsible Gaming

To monitor gambling behaviour, enforce player-requested limits and self-exclusion arrangements, and comply with safer gambling obligations described in our Responsible Gaming page.

3.4. Fraud Prevention & Security

To detect, prevent, and investigate fraud, money laundering, bonus abuse, multi-accounting, and other suspicious or unlawful activity. We may use automated decision-making tools to assist with this process; where such tools produce decisions with significant effects on you, you have the right to request human review (see Section 9).

3.5. Marketing & Communications

Where you have given your consent, to send you promotional emails, SMS messages, or push notifications about offers, bonuses, and new games. You may withdraw your consent and opt out of marketing communications at any time by clicking the "unsubscribe" link in any email or by contacting us at support@spinbobuk.com.

3.6. Analytics & Platform Improvement

To analyse usage patterns, improve website functionality, personalise your experience, and develop new features and services. This processing relies on our legitimate interests in operating a competitive and secure gaming platform.

3.7. Dispute Resolution & Legal Claims

To establish, exercise, or defend legal claims, respond to regulatory enquiries, and maintain records required by law.

4. Legal Bases for Processing

Under the UK GDPR, every processing activity must be supported by a lawful basis. The table below sets out the bases we rely upon:

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may request details of this balancing assessment by contacting our Data Protection Officer at privacy@spinbobuk.com.

5. Data Sharing & Third Parties

We do not sell your personal data. We may, however, share it with carefully selected third parties only where necessary and under appropriate safeguards:

5.1. Service Providers & Data Processors

We engage third-party companies to perform services on our behalf, including payment processing, identity verification (KYC), fraud analytics, cloud hosting, email delivery, and customer support platforms. These providers act as data processors and are contractually bound to handle your data only on our documented instructions and in compliance with UK GDPR.

5.2. Regulatory & Law Enforcement Bodies

We may disclose personal data to competent authorities, including regulators, law enforcement agencies, courts, and anti-money laundering reporting bodies, where we are legally required or permitted to do so.

5.3. Responsible Gaming Partners

Where you register a self-exclusion through a third-party scheme (such as GamStop), we share the minimum necessary data with that scheme to give effect to your exclusion. This sharing is conducted under a legal obligation and in your best interests.

5.4. Business Transfers

In the event of a merger, acquisition, or asset sale, your personal data may be transferred to the acquiring entity. We will notify you in advance and ensure the same level of data protection is maintained.

5.5. No Third-Party Marketing

We will never share your personal data with third-party marketers or advertisers without your explicit, separately obtained consent.

6. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies (such as web beacons, pixel tags, and local storage) in accordance with the Privacy and Electronic Communications Regulations (PECR). We deploy the following categories of cookies:

• Strictly Necessary Cookies: Essential for the website to function correctly, including session management, login authentication, and fraud prevention. These cannot be disabled without affecting core site functionality.
• Functional Cookies: Enable enhanced features and personalisation, such as remembering your language, currency, or preferred game lobby view.
• Analytics Cookies: Collect anonymous or pseudonymous data about how visitors use the site (e.g. via Google Analytics), helping us improve performance and user experience.
• Marketing & Targeting Cookies: Used (only with your consent) to deliver relevant advertisements and to measure the effectiveness of marketing campaigns across partner platforms.

When you first visit spinbobuk.com, a cookie consent banner will request your preferences for non-essential cookies. You may change or withdraw your consent at any time through your browser settings or by clearing your cookies. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal. For detailed information about every cookie we deploy, including their names, purposes, and lifespans, please consult our standalone Cookie Policy accessible via the website footer.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, alteration, or destruction. These measures include, but are not limited to:

• TLS/SSL encryption for all data transmitted between your device and our servers
• Encryption at rest for sensitive data fields, including payment credentials
• Role-based access controls ensuring that staff access only the data necessary for their specific responsibilities
• Regular security audits, penetration testing, and vulnerability assessments
• Firewalls, intrusion detection systems, and continuous server monitoring
• Staff training on data protection obligations and incident response procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach and, where required, will communicate the breach to you without undue delay.

8. Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected, taking into account our legal obligations and any applicable regulatory requirements.

• Account and transaction data: Retained for a minimum of five (5) years from the date of account closure or the last transaction, in accordance with AML legislation and financial record-keeping requirements.
• Identity verification documents: Retained for the same five-year minimum period, or longer if required by an ongoing investigation or regulatory instruction.
• Responsible gaming records: Retained for a minimum of five (5) years to support regulatory audits and to enforce self-exclusion periods effectively.
• Marketing opt-in records: Retained for as long as your marketing consent remains active, plus a reasonable evidence period thereafter.
• Technical and usage logs: Retained for up to twelve (12) months for security and analytics purposes, unless a specific incident requires longer retention.

Upon expiry of the relevant retention period, data is securely deleted or irreversibly anonymised so that it can no longer be attributed to you.

9. Your Rights

Under the UK GDPR, you hold a comprehensive set of rights regarding your personal data. These rights are detailed below, together with guidance on how to exercise them.

9.1. Right of Access (Subject Access Request)

You have the right to request a copy of the personal data we hold about you, together with information about how it is processed. We will respond to verified requests within one calendar month, extendable by a further two months for complex or numerous requests (we will notify you if an extension is needed). There is no fee for a standard request; however, we may charge a reasonable administrative fee for manifestly unfounded or excessive requests.

9.2. Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request correction or completion without undue delay. Where we have shared the inaccurate data with third parties, we will inform them of the rectification where reasonably practicable.

9.3. Right to Erasure ("Right to Be Forgotten")

You may request the deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (and there is no other lawful basis), or where you successfully object to the processing. This right is not absolute — we may decline or defer erasure where retention is required by law, such as AML record-keeping obligations.

9.4. Right to Restriction of Processing

You have the right to request that we restrict the processing of your data while you contest its accuracy, while we assess an objection you have raised, or where processing is unlawful but you prefer restriction to erasure.

9.5. Right to Data Portability

Where processing is based on your consent or on a contract with you, and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format, and transmit it directly to another controller where technically feasible.

9.6. Right to Object

You have the right to object at any time to processing carried out on the basis of our legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease that processing immediately without requiring justification. For other legitimate interests processing, we will cease unless we can demonstrate compelling legitimate grounds that override your interests.

9.7. Rights Related to Automated Decision-Making

Where we use solely automated processing — including profiling — to make decisions that produce legal or similarly significant effects on you (such as account suspensions or fraud flags), you have the right to request human review of that decision, to express your point of view, and to contest the outcome.

9.8. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

9.9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the supervisory authority for data protection in the United Kingdom:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us in the first instance at privacy@spinbobuk.com.

9.10. How to Exercise Your Rights

To submit any of the above requests, please contact our Data Protection Officer by email at privacy@spinbobuk.com or by writing to our registered correspondence address. We may ask you to verify your identity before processing a rights request to protect your data against unauthorised access.

10. International Data Transfers

We primarily store and process your personal data within the United Kingdom. However, some of our third-party service providers (such as cloud hosting providers, payment processors, or identity verification platforms) may operate in countries outside the UK.

Where we transfer personal data to a country not covered by a UK adequacy regulation, we ensure that appropriate safeguards are in place. These safeguards may include:

• UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses, as approved by the ICO
• Binding Corporate Rules (BCRs) approved by a competent supervisory authority
• Adequacy decisions made by the UK Secretary of State under Article 45 UK GDPR

You may request further details of the specific safeguards applicable to any particular transfer by contacting our Data Protection Officer at privacy@spinbobuk.com.

11. Minors

Our services are strictly intended for individuals aged 18 years or over. We do not knowingly collect or process personal data from anyone under 18. As part of our registration process, all users must confirm their age, and we conduct mandatory age verification checks in line with applicable regulatory requirements.

If we discover, or are notified, that personal data has been collected from a person under the age of 18, we will promptly delete that data and close the associated account. Parents or guardians who believe a minor may have registered with our services should contact us immediately at support@spinbobuk.com. For further details on our age verification and child safety measures, please refer to our Responsible Gaming page.

12. Changes to This Policy

We review and update this Privacy Policy periodically to reflect changes in our data processing practices, applicable legislation, or regulatory guidance. The version number and last updated date at the top of this document will always reflect the most current version.

Where changes are material — meaning they substantially affect your rights or the way we use your data — we will notify you by email or by posting a prominent notice on the website at least 14 days before the changes take effect. Your continued use of Spinbob after the effective date of any update constitutes your acknowledgement of the revised policy. If you do not agree with the changes, you should stop using our services and may request account closure and data deletion in accordance with Section 9.

13. Contact Information

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please use the contact details below:

13.1. Customer Support

• Email: support@spinbobuk.com
• Live Chat: Available through the Spinbob website

13.2. Data Protection Officer (DPO)

• Email: privacy@spinbobuk.com
• Subject line: Please use "Data Privacy Request" or "GDPR Enquiry" for prompt routing

13.3. Responsible Gaming Support

If you are concerned about your gambling behaviour or the behaviour of someone you know, the following UK organisations offer free, confidential, and professional support:

Further details on the responsible gaming tools available to Spinbob players — including deposit limits, time-outs, and self-exclusion — can be found on our dedicated Responsible Gaming page.